CVE-2025-5154Low· 2.3▾ TwilightPoC availableA vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a fi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 12.6 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
1 GitHub repo (last check)
A vulnerability was identified in PhonePe App 25.03.21.0 on Android. This affects an unknown function of the file /data/data/com.phonepe.app/databases/ of the component SQLite Database. The manipulation leads to cleartext storage in a file or on disk. The attack needs to be performed locally. The exploit is publicly available and might be used. The actual existence of this vulnerability is currently in question. The root-requirement of the attack is reflected by the CVSS vector attribute PR:H. The vendor explains: "[A]s per the PoC this vulnerability needs a rooted device to exploit. PhonePe does not consider vulnerabilities found in rooted device as valid because there is not real-world exploit scenario."
phonepe = 25.03.21.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90842Low· 3.7A weakness has been identified in PHPGurukul Blood Donor Management System 1.0
CVE-2026-111993Low· 3.3Soarkey StudentManagement AdminDao.java UserDao.login cleartext storage
CVE-2025-14836Low· 2.7A flaw has been found in ZZCMS 2025
CVE-2026-102539Medium· 5.7Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities
CVE-2026-62376High· 8.1Vikunja is an open-source self-hosted task management platform
CVE-2026-107807High· 8.8Nginx UI is a web user interface for the Nginx web server